dsh-local-hanaccount

Exposing DSH Web to the public internet raises one immediate question: who gets in, and how do you verify them? dsh-local-hanaccount is a single-operator access gate built for exactly that situation. By default it wraps every plugin webServer route behind a unified authentication wall, while leaving DSH native workspace and session management completely untouched.

Authentication spans both browser and command-line workflows. In the browser you can use a password (scrypt-hashed, with a 5-attempt lockout), a WebAuthn Passkey (fingerprint or face unlock, available over HTTPS or localhost), or an SSH ed25519 key through a challenge-and-verify flow for headless scripts. At the network layer, an IP whitelist lets trusted addresses bypass login entirely, an IP blacklist issues a permanent deny with a running block counter, and every suspicious source is logged for later review. For public deployments the plugin ships a copy-paste Nginx reverse-proxy snippet with X-Real-IP passthrough, and it can even auto-authenticate when Nginx already supplies a Basic Auth header. Cross-device peer tokens and manually issued API Bearer keys cover the remaining script-and-multi-device use cases without repeated password entry.

The target profile is clear: you are running DSH Web on a VPS or a home server, you want it reachable from your phone and laptop over the open internet, but you do not want to bolt on a heavyweight identity platform. Single operator, security-first, minimal operational overhead — that is the design boundary this plugin lives in.